ISE 3.1 email authentication

[KevinR99]

Hi

I'm testing sponsored guest access.  I've configured my smtp server in Work centers - Guest Access - SMTP server to use port 587.  I have not ticked the TSL/SSL box but in the Authentication settings I have added a valid username and password.  When I click Test connection it immediately comes back successful.  However, when I do a guest registratin I expect to see an email go to the sponsor and this doesn't happen.  In fact, after entering my test details and sponsor email address I get an error on the portal saying "An attempt to email your account information to you has failed"

I did a wireshark capture on the Test connection and it looks good.  However, when I do a wireshark on the test guest registration the capture shows an smtp 530 Authentication required error then the ISE resets the connection.  As I said, I have done a Test connection and it works.  I even tried the same with wrong credentials and as expected it fails.

Has anyone come across this issue?

Thanks, Kev

[KevinR99]

I should also have said, when I do tick the Ues TLS/SSL Encryption box and test the connection again I get an SSL error and directed to check trusted certificates.  So it would seem ISE does not trust the cert from the email server which is a public one.  If so why does the Test connection pass without the TLS/SSL box ticked ?

[KevinR99 · Accepted solution]

Update.  I did a further tcpdump when I have the TLS/SSL box ticked and from the I could see the cert signer that was being presented by my email provider.  I went to their website and downloaded  that root cert, installed it in ISE and tested again.  It works now.